3

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in i cannot log in

there is a method :

https://www.mysysadmintips.com/windows/clients/545-multiple-rdp-remote-desktop-sessions-in-windows-10

and i thought i can do it in memory and patch that instruction inside memory instead of disk, but found out SVCHOST processes have SYSTEM integrity and so i cannot inject into them and modify them

so how can this be done? any other way that i can do this without using any tool or disk modification?

EDIT : I'm not using a tool, its my own code, so is there any other way other than privilege escalation to SYSTEM? since that might not always be possible on windows 10. i thought maybe since its a task and not a process then there might be a trick to inject tasks or something

Improve this question

1 Answer 1

Reset to default
0

If the process is high-integrity, then you need to be running with either SYSTEM or Administrator privileges.

Since your exploit is evidently not providing the necessary privileges, you would need to escalate your privileges first. If you're using a common tool like Metasploit, there may be an escalation plugin that applies to your target. Given the automatic nature of Windows 10 patching, however, the built-in plugins rapidly go out of date.

Alternatively, you can exploit the system in a way that grants the necessary privileges. There's always a bit of research to determine what exploits are necessary for a particular demonstration. Sometimes there are none "out of the box", and you would have to create your own (or purposefully use an unpatched Windows instance).

Ultimately, the right tool for this situation (A) depends on the specific patch level and configuration of your target, and (B) may not exist for your target.

Improve this answer
4
  • But system is higher than Admin, the integrity of system is SYSTEM, running something as admin is HIGH (my code already runs as admin by default) so its lower, and I'm not using a tool its my own code, so is there any other way other than P.E? since that might not always be possible on windows 10. i thought maybe since its a task and not a process then there might be a trick to inject tasks or something
    – Max
    Commented Sep 16, 2019 at 14:18
  • 1
    You usually need the Debug Programs user right in order to freely modify memory. Administrators often have this right, but an administrator can usually grant it if it is not assigned by default. The calls for doing so are documented at docs.microsoft.com/en-us/windows/win32/secauthz/privileges
    – DoubleD
    Commented Sep 16, 2019 at 14:25
  • having a debug permission doesn't grant us the right to inject a SYSTEM process with a high integrity process
    – Max
    Commented Sep 17, 2019 at 9:34
  • A process cannot modify or create a process at a higher integrity level by design. If you cannot see/edit what you need with debug rights, which was a shot in the dark, then you'll need to compromise that design---so, yes, this requires an exploit.
    – DoubleD
    Commented Sep 17, 2019 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .